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Per our discussion on April 7, 2009, regarding Application # 10/761,894, 
Applicant suggests the following amendments as shown on the listing of claims 
beginning on the following page. 

Applicant would also suggest the following amendment to the specification: 

[074] If the reply is a RSET, SEND, SGMfeSOML, SAML, VRFY, NOOP, 

EXPN, HELP, or TURN command as shown in Fig. 8E then the algorithm relays the 
reply to MTA 1 and waits for a new reply. 

This was a typographical error. There is no SMTP command called "SCML" but 
rather SOML (see Postel Reference §3.4 on p. 1 1). An amendment is also suggested to 
claim 17. In the event such an amendment is not appropriate in an Examiner's 
amendment, Applicant is willing to submit it as a §1.312 amendment. 

Regarding the amendments to the claims, per our discussion an amendment was 
made to claim 1 and 16 to address potential §101 concerns. Applicant proposes 
amendments to claims 9-11 to correct consistency of language missed in the previous 
amendment of 9/29/2008. In addition to deleting system to address potential §101 
concerns and correcting the SCML/SOML typographical error in claim 17. Applicant 
proposes an amendment to step (11) to make it consistent with paragraph [059]. There is 
no 343 reply it is a typographical error and should be a 354 reply. Rather than amend 
claim 18, Applicant would suggest representing the claim as claim 20 which essentially is 
a method claim incorporating all limitations of claim 1, which the Examiner found is 
allowable. Some terms in the preamble used as an antecedent basis in claim 1 for its 
dependents claims have been omitted since claim 18/20 has no dependent claims. 

Should there be any discrepancies or remaining issues you may contact me on my 
mobile phone 858-382-7513. 

Best Regards, 
/Haw-minn I n 

Haw-minn Lu, Reg No. 55,407 
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Proposed Listing of Claims 

1) (Currently Amended) Ah A networked computer comprising an unsolicited message 
rejecting communications processor connected between message transfer agents 

MTA 0 with an Internet address IP O, a from-address A O, a declared domain 

D O, and a real domain DD 0, and 
MTA 1 with an Internet address IP 1, a domain D 1, and a to-address A 1 

comprising: 

a) monitoring means for monitoring the communications between MTA 0 and MTAl; 

b) determining means for determining if the communications contains a message that is 
unsolicited; 

c) intercepting means for intercepting a .\r\n end-of-message indicator reply from 
MTA 0, forcing MTA 0 to QUIT its connection with the unsolicited message 
rejecting communications processor by sending an error reply to MTA 0 if the 
message is determined to be unsolicited: 

wherein the unsolicited message rejecting communications processor does not 
intercept communications between MTA0 and MTA l before a .\r\n end-of- 
message indicator reply from MTA 0 is received by the unsolicited message 
rejecting communications processor. 

2) (Previously Presented) The unsolicited message rejecting communications processor 

in Claim 1, further includes an allowaddress database and wherein the determining 
means determines if the message is not unsolicited by checking if the IPO is in the 
allow address database. 

3) (Previously Presented) The unsolicited message rejecting communications processor 
in Claim 1, further includes a prevent address database and wherein the determining 
means determines if the message is unsolicited by checking if IP O is in the 
prevent address database. 

2 
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4) (Previously Presented) The unsolicited message rejecting communications processor 
in Claim 1, further includes access to an open relay database and wherein the 
determining means determines if the message is unsolicited by checking if IP O is in 
the open relay database. 

5) (Previously Presented) The unsolicited message rejecting communications processor 
in Claim 1, further includes access to a DNS (domain name server) database and 
wherein the determining means determines if the message is unsolicited by checking 
if IP 0 has a domain name entry DD 0 in the DNS database. 

6) (Previously Presented) The unsolicited message rejecting communications processor 
in Claim 1, further includes a bad from database and wherein the determining means 
determines if the message is unsolicited by checking if the from-address AO is in the 
bad from database. 

7) (Previously Presented) The unsolicited message rejecting communications processor 
in Claim I, further includes a suspectdomain database and wherein the determining 
means determines if the message is unsolicited by checking if the real domain DD 0 
matches the domain of the from-address A O and the domain of the from-address 

A O is in the suspect domain database. 

8) (Previously Presented) The unsolicited message rejecting communications processor 
in Claim 1, wherein the determining means determines if the message is unsolicited 
by checking if the from-address AO matches the to-address (A 1). 

9) (Currently Amended) The unsolicited message rejecting communications processor 
in Claim 1, further includes a no filter database and wherein the determining means 
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determines if the message is to be blocked rejected if it is determined to be 
unsolicited. 

10) (Currently Amended) The unsolicited message rejecting communications processor 
in Claim 1, wherein the det ermining means determines if a- the message is unsolicited 
by checking if the declared domain DO is the same as the domain D_l. 

1 1 ) (Currently .Amended) The unsolicited message rejecting communications processor 
in Claim 1, wherein the determining means determines if a the message is unsolicited 
by checking if the declared domain DO does not match the real domain DD 0 and 
the declared domain D O is in the suspect domain database. 

12) (Previously Presented) The unsolicited message rejecting communications processor 
in Claim 1, further includes a badword database and wherein the determining means 
determines if the message is unsolicited by checking if the subject line of the message 
contains any words in the bad word database. 

13) (Previously Presented) The unsolicited message rejecting communications processor 
in Claim 1, further includes a bad fingerprint database and wherein the determining 
means determines if the hash "fingerprint" of a portion of the body of the message is 
in the bad fingerprint database. 

14) (Previously Presented) The unsolicited message rejecting communications processor 
in Claim 1, further includes a rejected connection database which logs the time, 
from-address A 0, to-address A 1, and the reason for the rejection if the message is 
determined to be unsolicited. 
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15) (Previously Presented) The unsolicited message rejecting communications processor 
in Claim 1, further includes an allowed connection database which logs the time and 
to-address A_l if the message is determined not to be unsolicited. 
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16) (Currently Amended) A method for 

a receiving networked computer syst e m with an Internet connection, a message 
transfer agent MTAl, an Internet address IPl, a to-address A_l, and an 
operating system capable of executing the method 
to reject unsolicited messages from 

a transmitting networked computer system with an Internet connection and a 
message transfer agent MTA 0, an Internet address IP 0, a from-address A O, a 
declared domain D O, and from a real domain DD 0 

comprising the steps of: 

a) waiting for a new SMTP connection request; 

b) relaying and monitoring the replies from MTA 0 to MTA l; 

c) relaying replies from MTA l to MTA 0; 

d) intercepting the .\r\n end-of-message indicator reply from MT A_0 to MT A_l ; 

e) determining if the message is unsolicited by analyzing the monitored replies; 

f) releasing the intercepted .\r\n end-of-message reply if the message is determined not 
to be unsolicited; and 

g) sending an error reply to MTA 0 to force MTA 0 and MTA l to close down their 
connection; 

whereby MTA l controls the interaction between MTA 0 and MTA l until a .\r\n 
end-of-message indicator reply is received from MTA 0. 
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17) (Currently Amended) A method for 

a receiving networked computer syst e m with an Internet connection, a DNS 
server, and an open relay database, a message transfer agent MTAl, an IP 
address IP l, a domain name D_l, a to-address A_l, an allow address 
database, a prevent address database, a suspect_domain database, a bad_from 
database, a no filter database, a yes filter database, a bad word database, a 
bad fingerprint, a rejected connection database, an allowed connection 
database, and an operating system capable of executing the method 
to reject unsolicited messages from 

a transmitting networked computer system with an Internet connection, a 
message transfer agent MTA0, an IP address IP O, a declared domain D O, a 
real domain DD O, and a from-address A O 
comprising the steps of: 

a) waiting for a SMTP connection request on the receiving networked computer 
system's Internet connection; 

b) sending a 220 reply to MTA 0 to acknowledge the SMTP connection request; 

c) extracting the IP address IP O from the SMTP connection request; 

d) requesting the domain name DD O for IP O from the DNS server; 

e) testing if the domain name DD O is "no name"; 

f) testing if IP O is in the open relay database; 

g) testing if IP 0 is in the allow address database; 

h) testing if IP 0 is in the prevent address database[[,]]; 

i) requesting a connection with MTA l; 

j) waiting for a 220 reply from MTA l to acknowledge the requested connection; 

k) waiting for a reply from either MTA 0 or MTA 1; 

1) jumping to step o) if the reply is not from MTAl; 

m) relaying the reply from MTA 1 to MTA 0; 

7 
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n) jumping to step k) to wait for a new reply; 

o) jumping to step u) if the reply from MTA 0 is not a HELO; 

p) extracting the declared domain D O from the reply; 

q) testing if the declared domain D O mat ches the domain D_l ; 

r) testing if the declared domain D O does not match the real domain DD 0 AND the 

declared domain D O is in the suspect domain database; 
s) relaying the HELO reply from MTA 0 to MTA 1; 
t) jumping to step k) to wait for a new reply; 
u) jumping to step aa) if reply from MTA 0 is not a MAIL; 
v) extracting the from-address A O; 
w) testing if A O is in the bad from database; 

x) testing if DD 0 does not match the domain of A O and the domain of A O is in the 

suspect domain database; 
y) relaying MAIL reply to MTA 1; 
z) jumping to step k) to wait for a new reply; 
aa) jumping to step ii) if the reply from MTA 0 is not a RCPT; 
bb) extracting the to-address A_l; 
cc) testing if A 1 is in the no filter database; 
dd) testing if A O matches A 1; 
ee) testing if A O is in the no filter database; 
ff) testing if A O is in the yes filter database; 
gg) relaying RCPT reply to MTA l; 
hh) jumping to step k) to wait for a new reply; 
ii) jumping to step yy) if the reply from MTA 0 is not DATA; 
jj) relaying DATA to MTA 1; 
kk) waiting for a 354 reply from MTA l; 
11) relaying a^43 the 354 reply to MTA 0; 
mm) wait for the body of the message; 
nn) relaying the body of the message to MTAl; 
oo) waiting for a .\r\n end-of-message indicator; 

pp) testing if any word in the subject line of the message is in the bad word database: 
8 
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qq) testing if the hash "fingerprint" of a portion of the message is in the bad fingerprint 
database; 

it) jumping to step w) if NOT(t allow OR t no filter OR OR NOT t yes filter OR 
NOT ( t_prevent OR t open OR t_DD-) OR t bad from OR tsuspectdomain OR 
techodomain OR tforgeddomain OR tbadword OR t bad fingerpring)) ; 

ss) logging the time and the to-address A 1 in the allowed connection database; 

tt) relaying the .\r\n end-of-message indicator reply to MTA 1 to continue the 
conversation; 

uu) jumping to step k) to wait for a new reply; 

w) logging the time, the from-address A O, the to-address A_l, and the reason for 

rejecting the connection in the rejected connection database: 
ww) sending a 554 reply to MTA 0 to terminate the conversation; 
xx) jumping to step k) to wait for a new reply; 

yy) jumping to step ggg) if the reply from MTA 0 is not RSET, SEND, S€MtSOML, 
SAML, VRFY, NOOP, EXPN, HELP, or TURN; 

zz) relaying the reply to MTA_1; 

aaa) jumping to step j) to wait for a new reply; 

bbb) jumping to step ddd) if the reply from MTA0 is not a QUIT; 

ccc) relaying the QUIT reply to MTA 1; 

ddd) waiting for a 22 1 reply from MTA l 

eee) relaying the a 22 1 reply from MTA l to MTA 0; 

fff) jumping to step a) to wait for a new connection; 

ggg) sending a 500 reply to MTA_0 to signal a syntax error; and 

hhh) jumping to step a) to wait for a new connection. 

18) (Cancelled) 

19) (Cancelled) 

20) (New) A method in a networked computer comprising an unsolicited message 
rejecting communications processor connected between message transfer agents 
MTA 0 and MTA 1, said method comprising: 

9 
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monitoring communications between MTA 0 and MTA 1; 

determining if the communications contains a message that is unsolicited; and 

intercepting a .\r\n end-of-message indicator reply from MTA O, forcing MTA O 

to QUIT its connection with the unsolicited message rejecting communications 

processor by 

sending an error reply to MTA 0 if the message is determined to be 
unsolicited; 

wherein the unsolicited message rejecting communications processor does not 
intercept communications between MTA 0 and MTA 1 before a .\r\n end-of- 
message indicator reply from MTA 0 is received by the unsolicited message 
rejecting communications processor. 
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